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IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 

In re application of; Chris A. Barton et ah 

Application No.: 09/916,600 Group No.: 2137 

Filed: 07/26/2001 Examiner: Schubert, K. 

For: SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT FOR ANTI-VIRUS 
SCANNING IN A STORAGE SUBSYSTEM 

Mail Stop Appeal Briefs - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

TRANSMITTAL OF APPEAL BRIEF 
(PATENT APPLICATION-37 C.F.R. § 41*37) 

1. Transmitted herewith is the APPEAL BRIEF in this application, with respect to the Notice of 
Appeal filed on June 2, 2005. 

2. STATUS OF APPLICANT 

This application is on behalf of other than a small entity. 



CERTIFICATION UNDER 37 C.F.R §§ 1.8(a) and 1.10* 

(When using Express Mail, the Express Mail label number is mandatory; 
Express Mail certification is optional.) 

I hereby certify that, on the date shown below, this correspondence is being: 

MAILING 

_ deposited with the United States Postal Service in an envelope addressed to the Commissioner for Patents. P.O. Box 1450, Alexandria, VA 
22313-1450. 

37 C.F.R. § 1.8(a) 37 C.F.R. § 1.10* 

_ with sufficient postage as first class mail. _ as "Express Mail Post Office to Addressee" 

Mailing Label No. (mandatory) 

TRANSMISSION 

__ facsimile transmitted to the Patent and Trademark Office, (703) 872-9306. 



Date: ( / f / <LU^ ^> Erjca L _ Farlow 



$AA* Crf \Mn- 

v Slgnature 



(type or print name of person certifying) 



* Only the date of fifing (* 1.6) will be the date used in a patent term adjustment calculation, o! though the date on any certificate of mailing or 
transmission under ' 1.8 continues to be taken into account in determining timeliness. See ' 1. 703(f). Consider "Express Mail Post Office to 
Addressee " ( ' U 0) or facsimile transmission ( ' 1.6(d)) for the reply to be accorded the earliest possible filing dose for patent term adjustment 
calculations. 
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3. FEE FOR FILING APPEAL BRIEF 

Pursuant to 37 C.F.R. § 41 .20(b)(2), the fee for filing the Appeal Brief is: 

other than a small entity $500.00 
Appeal Brief fee due $500.00 

4. EXTENSION OF TERM 

The proceedings herein are for a patent application and the provisions of 37 C.F.R. 1. 136 apply. 

Applicant believes that no extension of term is required. However, this conditional petition is being 
made to provide for the possibility that applicant has inadvertently overlooked the need for a 
petition and fee for extension of time. 

5. TOTAL FEE DUE 
The total fee due is: 

Appeal brief fee $500.00 

Extension fee (if any) $0.00 

TOTAL FEE DUE $500.00 

6. FEE PAYMENT 

Authorization is hereby made to charge the amount of $500.00 to Deposit Account No. 50-1351 
(Order No. NAI1P020). 

A duplicate of this transmittal is attached. 

7. FEE DEFICIENCY 

If any additional extension and/or fee is required^anrfTrag^ additional fee for claims is required, 
charge Deposit Account No. 50-135 1 (Order Ntf NAI1P0J 
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RECEIVED 

CENTRAL FAX CENTER 

JUL Q 7 2005 



PATENT 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re the application of: 

Barton et al. 
Application No. 09/916,600 
Filed: 07/26/2001 



For: SYSTEM, METHOD AND COMPUTER 

PROGRAM PRODUCT FOR ANTI-VIRUS ) 
SCANNING IN A STORAGE SUBSYSTEM > 

) 



) 

) Group Art Unit: 2137 
) 

) Examiner: Schubert, Kevin R. 
) 

) Docket No. N A 1 1 P020/0 1 . 1 3 9.0 1 
) 

) July 7, 2005 
) 



Commissioner for Patents 

P.O. Box 1450 

Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

APPEAL BRIEF (37 C.F.R. § 41.37) 

This brief is in furtherance of the Notice of Appeal, filed in this case on June 2, 
2005. 

The fees required under § 1.17, and any required petition for extension of time for 
filing this brief and fees therefor, are dealt with in the accompanying 
TRANSMITTAL OF APPEAL BRIEF. 

This brief contains these items under the following headings, and in the order set 
forth below (37 C.F.R. § 41.37(c)(i)): 

I REAL PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 
ID STATUS OF CLAIMS 

07/11/2005 HGUTEKA1 00000030 501351 09918600 
01 FC:1402 500.00 DA 
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IV STATUS OF AMENDMENTS 

V SUMMARY OF CLAIMED SUBJECT MATTER 

VI ISSUES 

VII ARGUMENTS 

VIII APPENDIX OF CLAIMS INVOLVED IN THE APPEAL 

IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE 
APPELLANT IN THE APPEAL 

The final page of this brief bears the practitioner's signature. 
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I REAL PARTY IN INTEREST (37 C.F.R. § 41.37(c)(l)(i)) 
The real party in interest in this appeal is McAfee, Inc. 
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II RELATED APPEALS AND INTERFERENCES (37 C.F.R. § 41 31(c) 

(D00) 



With respect to other prior or pending appeals, interferences, or related judicial 
proceedings that will directly affect, or be directly affected by, or have a bearing on 
the Board's decision in the pending appeal, there are no other such appeals, 
interferences, or related judicial proceedings. 

Since no such proceedings exist, no Related Proceedings Appendix is appended 
hereto. 
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III STATUS OF CLAIMS (37 C.F.R. § 41.37(c) (l)(iii)) 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims in the application are: 1,2, 4-7, 10-1 8, 20-23 and 26-43 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . Claims withdrawn from consideration: None 

2. Claims pending: 1 , 2 5 4-7, 10-18, 20-23 and 26-43 

3. Claims allowed: None 

4. Claims rejected: 1 , 2, 4-7, 10-1 8, 20-23 and 26-43 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1, 2, 4-7, 10-18, 20-23 and 26-43 
See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R. § 41.37(c)(l)(iv» 

As to the status of any amendment filed subsequent to final rejection, there are no 
such amendments after final. 
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V SUMMARY OF CLAIMED SUBJECT MATTER (37 C.F.R. § 
41.37(c)(l)(v)) 

With respect to a summary of Claim 1 et al., as shown in Figures 2 and 4, a method 
for scanning data read from storage is provided including receiving a request for 
data saved in storage from a central processing unit (e.g. item 402 of Figure 4). In 
use, the requested data is scanned for malicious code (e.g. item 406 of Figure 4) and 
the data is transmitted from the storage to the central processing unit if malicious 
code is not found in the data during the scanning (e.g. item 410 of Figure 4). In 
addition, the scanning is performed by a scanning module coupled to a storage 
subsystem controller (e.g. items 208 and 204 of Figure 2). Furthermore, a user is 
allowed to disable the scanning module, and data is precluded from being 
transmitted from the storage to the central processing unit upon the disabling of the 
scanning module (e.g. items 404, 418 and 416 of Figure 4). Note page 6, and page 
9, line 6 -page 10, line 31, for example. 

With respect to a summary of Claim 35, the above summary is incorporated, at least 
in part, by reference. Further provided is a system that includes storage (e.g. item 
202 of Figure 2) for saving data therein, a storage subsystem controller (e.g. 204 of 
Figure 2) coupled to the storage for controlling access to the data saved therein, and 
a central processing unit (e.g. item 206 of Figure 2) coupled to the storage 
subsystem controller for issuing read requests for reading the data saved therein for 
processing purposes, and write requests for writing data to the storage. Also 
included is a scanning module (e.g. item 208 of Figure 2) coupled to the central 
processing unit and the storage subsystem controller. The scanning module is 
adapted for identifying the requests from the central processing unit, and scanning 
the data for malicious code in response to the requests. An event manager module 
(e.g. item 346 of Figure 3) is coupled to the scanning module and the central 
processing unit. The event manager module is adapted for receiving results of the 
scanning from the scanning module. The event manager module is further adapted 
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to execute an event based on the results of the scanning. Additionally, the central 
processing unit is conditionally allowed to read the data saved in the storage and 
write data to the storage based on the results of the scanning (e.g. item 419 of Figure 
4 and item 519 of Figure 5) and a user is allowed to disable the scanning module. 
Data is precluded from being transmitted between the storage and the central 
processing unit upon the disabling of the scanning module (e.g. items 404, 418 and 
416 of Figure 4). Note page 5, line 13 - page 12, line 23, for example. 
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VI ISSUES (37 C.F.IL § 4137(c)(l)(vi)) 

Following, under each issue listed, is a concise statement setting forth the 
corresponding ground of rejection. 

Issue # 1: The Examiner has rejected Claim 42 under 35 U.S.C. 1 12, first paragraph. 

Issue # 2: The Examiner has rejected Claims 1-40 under 35 U.S.C. 103(a) as being 
unpatentable over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. 
Patent No. 6,735,700. 

Issue # 3: The Examiner has rejected Claim 41 under 35 U.S.C. 103(a) as being 
unpatentable over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. 
Patent No. 6,735,700, in further view of Browne, U.S. Patent No. 6,272,533. 
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Vn ARGUMENTS (37 C.F.R. § 4L37(c)(l)(vii)) 

The claims of the groups noted below do not stand or fall together. In the present 
section, appellant explains why the claims of each group are believed to be 
separately patentable. 

Tssue # 1 : 

The Examiner has rejected Claim 42 under 35 U.S.C. 112, first paragraph. 

Group #1: Claims 42 and 43 

Specifically, the Examiner has stated that '[n]o where in the Specification does the 
appellant describe that it is determined whether the storage is disabled "only after" 
determining whether the scanning module is disabled.' Appellant respectfully 
disagrees with such rejection in view of the clear support for such claim language in 
Figure 5 of appellant's originally-filed application, as shown below. 
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Appellant points out step 504 of Figure 5, wherein it is first determined whether the 
scanner is disabled. Next, and only if the scanner has been disabled, as depicted by 
the Yes arrow from 504, is it next determined if the storage is disabled (operation 
518). Thus, operation 518 occurs, as shown, only after operation 504 (and not after 
any other operations shown). To this end, appellant's claimed technique "wherein it 
is determined whether the storage is disabled only after determining whether the 
scanning module is disabled" (see Claim 42) is fully supported by the specification 
with regard to Figure 5. 

It is noted that the Examiner has rejected Claim 43 as being dependent on Claim 42. 
In view of the remarks made hereinabove, a notice of allowance or a specific prior 
art showing of all of such claim limitations, in combination with the remaining claim 
elements, is respectfully requested. 

Issue #2: 

The Examiner has rejected Claims 1-40 under 35 U.S.C. 103(a) as being 
unpatentable over Makita, U.S. Palent No. 2001/0007120, in view of Flint, U.S. 
Patent No. 6,735,700. 

Group #7; Claims 1, 2, 4, 5, JO, 11, 15-17, 18, 20, 21, 26, 27, 31-34 and 39 

With respect to Claim 1, the Examiner continues to rely on the following excerpt 
from Flint to meet appellant's claimed "wherein a user is allowed to disable the 
scanning module, and data is precluded from being transmitted from the storage to 
the central processing unit upon the disabling of the scanning module." 

"The third activity waits for user input (block 421) . When 
user input is received, it is evaluated to determine if the 
user has requested that a particular file be scanned (block 
4 23) . If so, an on-demand scan is performed using the 
requested file as the scan set as described below with 
reference to FIG . 6. If the user input specifies the 
termination of the anti-virus program (block 427), a 
termination process illustrated by block 429 and described in 
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more detail below in conjunction with FIG. 8 is performed. 

When the user has previously requested the scanning facility 
be stopped {as described next) , the user can request it be 
restarted (block 431) . Any other user input, including a 
request to stop the scanning facility, is processed at block 
433. Such user input also includes changing preference 
parameters that control the overall functioning of the anti- 
virus software. The user can also specify which files to 
include in a pre-defined scan set that is used by the on- 
demand scan of FIG. 6. The handling of such user input is well 
understood in the art and is not discussed further. Moreover, 
it will be appreciated that the input interface is 
conventional and thus not illustrated." (Col. 9, lines 5-24 - 
emphasis added) 



Appellant respectfully asserts that the above excerpt from Flint simply discloses "[i]f 
the user input specifies the termination of the anti-virus program (block 427), a 
termination process illustrated by block 429 and described in more detail below in 
conjunction with FIG. 8 is performed". Thus, Flint only teaches a user terminating 
the anti-virus program, and not "data is precluded from being transmitted from the 
storage to the central processing unit upon the disabling of the scanning module," as 
claimed by appellant. 



To further clarify this distinction, appellant respectfully points out Fig. 8 in Flint, as 
referred to in the above excerpt. Specifically, Fig. 8 teaches writing to permanent 
storage (block 803) even after a user has specified to terminate the anti-virus 
program (block 429 of Fig. 4). Appellant respectfully asserts that this clearly 
teaches away from appellant's claim language since appellant specifically claims 
"data is precluded from being transmitted from the storage to the central processing 
unit upon the disabling of the scanning module" (emphasis added). Allowing the 
data to be written to storage or read from storage without fully completing a scan, as 
in Flint, would provide the opportunity for malicious code to execute and/or 
proliferate on the systems sought to be protected. Appellant's claimed invention is 
clearly capable of avoiding such a situation. 



In the Advisory Action dated 5/16/2005, the Examiner has argued that Makita, in 
combination with Flint, teaches appellant's claim language. Specifically, the 
Examiner has argued that Makita teaches "[t]he storage location retrieves the data 
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and performs an internal virus check on the data before it sends the data back to the 
cpu (host) ([0I80]-[O184])." Additionally, the Examiner has argued that Flint 
teaches the idea of a user being able to disable and enable a virus scanning module 
(Col. 9, lines 5-24). From this, the Examiner has concluded that the combination of 
such teachings meet appellant's claimed method "wherein a user is allowed to 
disable the scanning module, and data is precluded from being transmitted from the 
storage to the central processing unit upon the disabling of the scanning module." 

Appellant respectfully disagrees. Makita merely teaches two scenarios. First, if a 
virus is found during the virus check, transmission to the host is stopped ([001 83]). 
Second, if a virus is not found during the virus check, the information is transmitted 
to the host ([001 84]). Clearly, there is no disclosure of the result when no virus 
check is performed, since Makita does not allow for this option. Thus, only 
appellant teaches and claims that ''data is precluded from being transmitted from the 
storage to the central processing unit upon the disabling of the scanning module. 1 * 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art, 
to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references 
when combined) must teach or suggest all the claim limitations. The teaching or 
suggestion to make the claimed combination and the reasonable expectation of 
success must both be found in the prior art and not based on appellant's disclosure. 
In re Vaeck.947 F.2d 488, 20 USPQ2d 1438 (Fed.Cir.1991). 

Appellant respectfully asserts that at least the third element of the prima facie case 
of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. A notice of 
allowance or a specific prior art showing of all of appellant's claim limitations, in 
combination with the remaining claim elements, is respectfully requested. 
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Group # 2; Claims 35-38 

With respect to independent Claim 35, the Examiner has relied on Figure 15 item 
413 of Makita to make a prior art showing of appellant's claimed "scanning module 
coupled to the central processing unit and the storage subsystem controller, the 
scanning module adapted for identifying the requests from the central processing 
unit, and scanning the data for malicious code in response to the requests." 

Appellant respectfully asserts that item 413 of Figure 15 is a virus check unit to 
which "information to be recorded corresponding to the command is supplied" (see 
[0174] in Makita). Having information supplied to a virus check unit simply does 
not meet "scanning module adapted for identifying requests from the central 
processing unit," as claimed by appellant (emphasis added). 

Further, the Examiner has relied on Makita's disclosed file management unit (Figure 
15 item 211) and the following excerpts from Makita to make a prior art showing of 
appellant's claimed "event manager module coupled to the scanning module and the 
central processing unit, the event manager module adapted for receiving results of 
the scanning from the scanning module, the event manager module adapted to 
execute an event based on the results of the scanning": 

*The file management unit 121 manages the storage of files 
into, the readout and deletion of files from, and access 
rights o the recording medium 4 of the external storage 120. 
The file management unit 121 includes programs for managing 
the recording medium 4 formatted into a desired logical format 
in formats corxesponding to operation systems such as 12 -bit 
FAT (File Allocation Table) of MS-DOS , the 16 -bit FAT of MS- 
DOS, and UNIX." [0091] 

"When a virus is discovered in step S8-5, a transmission to 
the host computer 110 is stopped, and the host computer 110 is 
notified that the virus is discovered (step SB-6)." [0183] 

Appellant respectfully asserts that a file management unit that manages files, 
manages access to files, and manages the formatting of files along with stopping a 
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transmission to the host computer when a virus is discovered as disclosed in Makita 
(see excerpts above) fails to meet ki the event manager module adapted for receiving 
results of the scanning from the scanning module, the event manager module 
adapted to execute an event based on the results of the scanning/ 1 as claimed by 
appellant (emphasis added). Simply nowhere in Makita is there any suggestion of 
an "event manager module" that is "adapted for receiving results of the scanning" 
and "adapted to execute an event based on the results of the scanning/' as claimed. 

In the Advisory Action dated 5/16/2005, the Examiner has relied on paragraph 
[01 74] of Makita in arguing that the CPU in Makita sends a request to the scanning 
module to scan for data. Thus, the Examiner has concluded that the scanning 
module must be adapted for identifying the requests from the CPU since it is 
adapted to receive requests for a data scan. 

Appellant respectfully asserts that Makita merely teaches that "[w]hen a command 
to record information on the recording medium 4 is supplied from the host computer 
1 10 (step S7-1), information to be recorded corresponding to the command is 
supplied to the virus check engine unit 413" (emphasis added). Thus, the virus 
check engine in Makita is not adapted for identifying requests, since no request is 
ever made by the host computer. In particular, the information in Makita is simply 
su pplied to the virus check engine, and a request is not utilized. To emphasize, the 
host computer in Makita does not send a request to the scanner, but simply sends the 
information to the scanner. Thus, the scanner in Makita does not have a request to 
identify or respond to since it is only the information itself which is being sent to the 
scanner and not a request . 

In addition, in the Advisory Action dated 5/16/2005, the Examiner has relied on the 
file management unit as described in Makita paragraph [0091], in supporting the 
present rejection. However, appellant respectfully asserts that such file management 
unit simply manages 'the storage of files into, the readout and deletion of files from, 
and access rights to the recording medium 4 of the external storage 120" ([0091]). 
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Thus, the file management unit only manages files with respect to the recording 
medium. 

In Makita, the only mention of scanning such files relates to scanning them when 
information is read out from the recording medium (see paragraph [01 81]). Then, 
after the scanning, it is determined whether the file is transferred to a host computer 
(see paragraphs [0182]-[0184]). Since the file management unit only manages files 
with respect to the recording medium, such file management unit does not manage 
files with respect to their transmission from the virus check unit to the host 
computer. Therefore, clearly appellant's claimed "event manager module coupled to 
the scanning module and the central processing unit, the event manager module 
adapted for receiving results of the scanning from the scanning module, the event 
manager module adapted to execute an event based on the results of the scanning" 
has not been met by the Makita reference. 

Again, at least the third element of the prima facie case of obviousness has not been 
met, since the prior art references, when combined, fail to teach or suggest all of the 
claim limitations, as noted above. A notice of allowance or a specific prior art 
showing of aU of appellant's claim limitations, in combination with the remaining 
claim elements, is respectfully requested. 

Group # 3; Claims 6 and 22 

With respect to dependent Claim 6 et aL, the Examiner has relied on Makita* s 
paragraph [0213] to meet appellant's claimed technique "wherein the scanning 
module includes software." Appellant respectfully asserts that paragraph [02 13] of 
Makita simply teaches that the "virus check can be performed even if a virus check 
program is not installed on the host computer." Thus, the only virus check software 
program disclosed in Makita relates to a virus checker on the host computer , and not 
that the scanning module (i.e. virus checker) includes software. 
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Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Group # 4: Claims 7 and 23 

With respect to dependent Claim 7 et al., the Examiner has relied on Figure 15 of 
Makita to meet appellant's claimed technique 'Svherein the scanning module 
includes hardware." Appellant respectfully asserts that Figure 15 merely shows that 
the virus check unit 413 is included in the external storage 4 (which may include 
logic stored on the external storage 4) and not that the virus check unit includes 
hardware itself. 

Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Group # 5: Claims 12 and 28 

With respect to dependent Claim 12 et al., the Examiner has relied on paragraph 
[0183] of Makita to make a prior art showing of appellant's claimed technique 
'Svherein the event includes disabling the scanning module in response to the event." 
Appellant respectfully asserts that the above cited reference from Makita merely 
teaches that "a transmission to the host computer 1 10 is stopped" ([01 83]). Thus, 
there is simply no disclosure of any sort of "disabling [of] the scanning module" and 
especially not "in response to the event," as claimed by appellant. 

Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 
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Group # 6: Claims 14 and 30 

With respect to dependent Claim 14 et al 5 the Examiner has relied on Makita's 
teaching of formatting the recording medium ([0053]-[0054]) to make a prior art 
showing of appellant's claimed technique '"wherein the scanning includes content 
scanning." The Examiner has stated that content scanning is used to determine a 
format of the data and to format the data. However, Makita clearly only teaches 
formatting the recording medium (see specifically paragraph [0054]) and not 
providing content scanning of the requested data for malicious code, in the manner 
claimed by appellant. 

Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Group # 7: Claim 40 

With respect to dependent Claim 40, the Examiner has continued to rely on Flint's 
disclosed system where "[t]he user or administrator also faces the challenges 
inherent in maintaining the external database" (Col. 2, lines 19-20) to make a prior 
art showing of appellant's claimed technique "wherein the user includes a remote 
administrator." 

Appellant respectfully asserts that Flint's basic mention of an administrator that 
maintains an external database docs not meet appellant's "user [that] includes a 
remote administrator" (Claim 40) in the context of appellant's claim language, such 
that the "user is allowed to disable the scanning module" (see independent Claim I). 

In the Advisory Action dated 5/16/2005, the Examiner argued that Flint does not 
provide support for a user being an administrator, but that Flint discloses that a user 
or administrator can maintain a similar system to that of Makita's and appellant's. 
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The Examiner then concludes by stating that "Flint provides support that a user can 
be an administrator." 

Appellant respectfully asserts that the Examiner's arguments are not clear. First the 
Examiner states that Flint does not support a user being an administrator, and then 
the Examiner goes on to state that Flint does provide support that a user can be an 
administrator. Appellant again argues that the only administrator disclosed in Flint 
relates to an administrator who maintains a database, and not a remote administrator 
who can disable the scanning module, as claimed by appellant (see Claim 40 which 
depends from Claim 1). 

Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Issue # 3: 

The Examiner has rejected Claim 41 under 35 U.S.C. 103(a) as being unpatentable 
over Makita, U.S. Patent No. 2001/0007120, in view of Flint, U.S. Patent No. 
6,735,700, in further view of Browne, U.S. Patent No. 6,272,533. 

Group # 1: Claim 41 

With respect to dependent Claim 41, the Examiner has relied on Browne to make a 
prior art showing of appellant's claimed technique "wherein the user is allowed to 
disable the storage, and the data is precluded from being transmitted to the storage 
from the central processing unit upon the disabling of the storage " Specifically, the 
Examiner has stated that Browne discloses a secure computing system in which a 
manual switch can be pressed so that data is precluded from being written to a 
storage device. 



-19- 
page 24/35 * RCVD AT 7/7/2005 1 :29:09 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-1/3 * DN]S:8729306 ' CSID:408 97 1 4660 * DURATION (mm-SS):09-36 ra 



JuT 07 05 10:36a SVIPG 



408 971 4GG0 



p. 25 



Appellant respectfully asserts that Browne merely teaches the "disabling [of the] 
alteration of data residing on a mass storage device" (see Abstract). Thus, simply 
disabling the alteration of data, as in Browne, does not meet appellant's specifically 
claimed "disabling of the storage," let alone disabling the storage such that "data is 
precluded from being transmitted to the storage from the central processing unit 
upon the disabling of the storage." 

Again, a notice of allowance or a specific prior art showing of each of the foregoing 
limitations, in combination with the remaining claim elements, is respectfully 
requested. 

In view of the remarks set forth hereinabove, all of the independent claims are 
deemed allowable, along with any claims depending therefrom. 
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VIII APPENDIX OF CLAIMS (37 C.F.R. § 41.37(c)(l)(viii)) 

The text of the cfaims involved in the appeal (along with associated status 
information) is set forth below: 

1. (Previously Presented) A method for scanning data read from storage, 
comprising: 

a) receiving a request for data saved in storage from a central processing 

unit; 

b) scanning the requested data for malicious code; and 

c) transmitting the data from the storage to the central processing unit if 
malicious code is not found in the data during the scanning; 

wherein the scanning is performed by a scanning module coupled to a 
storage subsystem controller; 

wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted from the storage to the central processing unit 
upon the disabling of the scanning module. 

2. (Original) The method as recited in claim 1, wherein the storage is 
selected from the group consisting of a hard drive, compact disc-read only memory 
(CD-ROM), and a floppy disk. 

3. (Cancelled) 

4. (Previously Presented) The method as recited in claim 1, wherein the 
storage subsystem controller is coupled to a storage driver which is coupled to the 
central processing unit, where the storage driver is coupled between the storage 
subsystem controller and the central processing unit, so that the storage subsystem 
controller and the central processing unit must communicate therethrough. 
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5. (Previously Presented) The method as recited in claim I, wherein the 
storage subsystem controller is coupled to the storage. 

6. (Previously Presented) The method as recited in claim 1, wherein the 
scanning module includes software. 

7. (Previously Presented) The method as recited in claim 1 , wherein the 
scanning module includes hardware. 

8. (Cancelled) 

9. (Cancelled) 

10. (Original) The method as recited in claim 1, and further comprising 
executing an event based on results of the scanning. 

1 1 . (Original) The method as recited in claim 1 0, wherein the event 
includes an alert, 

12. (Original) The method as recited in claim 10, and fiirther comprising 
disabling the scanning module in response to the event. 

13. (Cancelled) 

14. (Original) The method as recited in claim 1, wherein the scanning 
includes content scanning. 

1 5. (Original) The method as recited in claim 1 ? wherein the scanning 
includes virus scanning. 
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16, (Original) The method as recited in claim 1, wherein the storage is 
accessible via a network. 

1 7. (Previously Presented) A computer program product for scanning 
data read from storage, comprising: 

a) computer code for receiving a request for data saved in storage from 
a central processing unit; 

b) computer code for scanning the requested data for malicious code; 

and 

c) computer code for transmitting the data from the storage to the 
central processing unit if malicious code is not found in the data during the 
scanning; 

wherein the scanning is performed by a scanning module coupled to a 
storage subsystem controller; 

wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted from the storage to the central processing unit 
upon the disabling of the scanning module. 



18. (Original) The computer program product as recited in claim 17, 
wherein the storage is selected from the group consisting of a hard drive, compact 
disc-read only memory (CD-ROM), and a floppy disk. 

19. (Cancelled) 

20. (Previously Presented) The computer program product as recited in 
claim 17, wherein the storage subsystem controller is coupled to a storage driver 
which is coupled to the central processing unit, where the storage driver is coupled 
between the storage subsystem controller and the central processing unit, so that the 
storage subsystem controller and the central processing unit must communicate 
therethrough. 
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21 . (Previously Presented) The computer program product as recited in 
claim 17, wherein the storage subsystem controller is coupled to the storage. 

22. (Previously Presented) The computer program product as recited in 
claim 17, wherein the scanning module includes software. 

23. (Previously Presented) The computer program product as recited in 
claim 17, wherein the scanning module includes hardware. 

24. (Cancelled) 

25. (Cancelled) 

26. (Original) The computer program product as recited in claim 19, and 
further comprising computer code for executing an event based on results of the 
scanning. 

27. (Original) The computer program product as recited in claim 26 s 
wherein the event includes an alert. 

28. (Original) The computer program product as recited in claim 26, and 
further comprising computer code for disabling the scanning module in response to 
the event. 

29. (Original) The computer program product as recited in claim 28, 
wherein data is precluded from being transmitted from the storage to the central 
processing unit upon the disabling of the scanning module. 

30. (Original) The computer program product as recited in claim 17, 
wherein the scanning includes content scanning. 
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3 1 . (Original) The computer program product as recited in claim 1 7, 
wherein the scanning includes virus scanning. 

32. (Original) The computer program product as recited in claim 17, 
wherein the storage is accessible via a network. 

33. (Previously Presented) A method for scanning data written to storage, 
comprising: 

a) receiving a request for data to be written in storage, the request being 
received from a central processing unit; 

b) scanning the data for malicious code; and 

c) writing the data to the storage if malicious code is not found in the 
data during the scanning; 

wherein the scanning is performed by a scanning module coupled to a 
storage subsystem controller; 

wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted to the storage from the central processing unit 
upon the disabling of the scanning module, 

34. (Previously Presented) A computer program product for scanning 
data written to storage, comprising: 

a) computer code for receiving a request for data to be written in 
storage, the request being received from a central processing unit; 

b) computer code for scanning the data for malicious code; and 

c) computer code for writing the data to the storage if malicious code is 
not found in the data during the scanning; 

wherein the scanning is performed by a scanning module coupled to a 
storage subsystem controller; 
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wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted to the storage from the central processing unit 
upon the disabling of the scanning module. 

35. (Previously Presented) A system for scanning data read from storage, 
comprising: 

a) storage for saving data therein; 

b) a storage subsystem controller coupled to the storage for controlling 
access to the data saved therein; 

c) a central processing unit coupled to the storage subsystem controller 
for issuing read requests for reading the data saved therein for processing purposes, 
and write requests for writing data to the storage; 

d) a scanning module coupled to the central processing unit and the 
storage subsystem controller, the scanning module adapted for identifying the 
requests from the central processing unit, and scanning the data for malicious code 
in response to the requests; and 

e) an event manager module coupled to the scanning module and the 
central processing unit, the event manager module adapted for receiving results of 
the scanning from the scanning module, the event manager module adapted to 
execute an event based on the results of the scanning; 

f) wherein the central processing unit is conditionally allowed to read 
the data saved in the storage and write data to the storage based on the results of the 
scanning; 

g) wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted between the storage and the central processing unit 
upon the disabling of the scanning module. 

36. (Original) The system as recited in claim 35, wherein the scanning 
module is coupled to the storage subsystem controller via a bus. 
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37. (Original) The system as recited in claim 35, wherein the scanning 
module is directly coupled to the storage subsystem controller. 

38. (Previously Presented) The system as recited in claim 35, wherein the 
scanning module is coupled to the storage subsystem controller via a storage driver, 
where the storage driver is coupled between the storage subsystem controller and the 
central processing unit, so that the storage subsystem controller and the centTa) 
processing unit must communicate therethrough. 

39. (Previously Presented) A system for scanning data read from storage, 
comprising: 

a) means for saving data therein; 

b) means for controlling access to the data saved therein; 

c) means for issuing read requests for reading the data saved therein for 
processing purposes and write requests for writing data to the storage; 

d) means for identifying the requests from the central processing unit, 
and scanning the data for malicious code in response to the requests; and 

e) means for receiving results of the scanning from the scanning 
module, the event manager module adapted to execute an event based on the results 
of the scanning; 

f) wherein the central processing units is conditionally allowed to read 
the data saved in the storage and write data to the storage based on the results of the 
scanning; 

g) wherein a user is allowed to disable the scanning module, and data is 
precluded from being transmitted between the storage and the central processing unit 
upon the disabling of the scanning module. 

40. (Previously Presented) The method as recited in claim 1, wherein the 
user includes a remote administrator. 
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41 . (Previously Presented) The method as recited in claim 1, wherein the 
user is allowed to disable the storage, and the data is precluded from being 
transmitted to the storage from the central processing unit upon the disabling of the 
storage. 

42. (Previously Presented) The method as recited in claim 41 } wherein it 
is determined whether the storage is disabled only after determining whether the 
scanning module is disabled, 

43. (Previously Presented) The method as recited in claim 42, wherein 
the disabling and enabling of the storage and the scanning module provides 
increased functionality in conditionally precluding transmission of the data to the 
storage from the central processing unit. 
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IX APPENDIX LISTING ANY EVIDENCE RELIED ON BY THE 
APPELLANT IN THE APPEAL (37 C.F.R. § 4L37(c)(l)(ix)) 

There is no such evidence. 
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In the event a telephone conversation would expedite the prosecution of this application, 
the Examiner may reach the undersigned at (408) 971-2573. For payment of any 
additional fees due in connection with the filing of this paper, the Commissioner is 
authorized to charge such fees to Deposit Account No. 50-135 1 (Order No. 
NAI1P020JM. 139.01). 

Respectfully suhnritted, / . 



Reg. No. 41,429 



Zilka-Kotab, P.C. 

P.O. Box 721120 

San Jose, California 95172-1 120 

Telephone: (408) 971-2573 

Facsimile: (408)971-4660 
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